51–60 of 159 posts
At this point, Wikipedia is one of the few websites I use regularly that actually works in this way.
What? A DNS lookup doesn't include anything but the hostname and anything following a hash is never sent with a request from the browser.
It seems that “privacy researcher at brave” is a job requiring no domain knowledge, only plentiful contact with credulous journalists.
Earlier quoted context omitted.
I think the idea there is that there would be lazy-loaded content from another site that would only load when someone scrolled far enough to see the highlighted word, which will automatically happen with this feature. The title of the Forbes article is too hyperbolic for my tastes and while this could be a security concern in very specific situations it's being overblown.
I think that would need to be a designed attack, not something that would apply to 99% of websites. The only legitimate resource (that could be used as a canary) being loaded far down a page would be an image (and that kind of requires it to be lazy loading as well).
Confused. As I understand it, anything after the # in a uri isn't sent over the wire. So the only way someone could see that you're navigating to a specific fragment is some sort of deep chrome logging, or chrome plugin, etc. And if that's the case, cat's already out of the bag for everything you do already.
Could someone explain this a bit better? I've read two articles on this this morning and I still don't understand what the privacy concerns are with this feature. Thanks!
"Consider a situation where I can view DNS traffic (e.g. company network), and I send a link to the company health portal, with [the anchor] #:~:text=cancer. On certain page layouts, I might be able [to] tell if the employee has cancer by looking for lower-on-the-page resources being requested.”
So they could send someone a link to a page with a fragment, trick them into clicking it, and matching text and watch for DNS requests being lazy-loaded to learn the fact that they clicked it.
It's convoluted nonsense.
EDITED and hour later: A couple of people have pointed out it's back, they've made some changes and marked it as public now. There was another article on this same topic this morning with this: "Google's engineers have not ignored worries about the security and privacy risks. To their credit, they've gathered them together into a single document and they've clearly been engaged in understanding what people are worrie…
EDITED and hour later: A couple of people have pointed out it's back, they've made some changes and marked it as public now. There was another article on this same topic this morning with this: "Google's engineers have not ignored worries about the security and privacy risks. To their credit, they've gathered them together into a single document and they've clearly been engaged in understanding what people are worrie…
What? A DNS lookup doesn't include anything but the hostname and anything following a hash is never sent with a request from the browser.
The quote about DNS seems wrong to me ""Consider a situation where I can view DNS traffic (e.g. company network), and I send a link to the company health portal, with #:~:text=cancer," he wrote. "On certain page layouts, I might be able [to] tell if the employee has cancer by looking for lower-on-the-page resources being requested."" I thought DNS requests just get the domain, not the hash and not even the page reque…
eg on a company network, it would be common to install an SSL cert on all devices on the private network for things like web proxies, CASBs, or other security policy enforcement measures.